EASA Part-IS - Information Security in Aviation IS.I.OR.250: Information security management manual (ISMM)

What does IS.I.OR.250 require?

The organisation must make available to the competent authority an ISMM, with any referenced manuals and procedures, containing a statement signed by the accountable manager (countersigned by the CEO if different) that the organisation will always work in accordance with the Annex and the ISMM; the titles, names, duties, accountabilities, responsibilities and authorities of the 240(b) and (c) persons and of any common responsible person; the information security policy; a description of staff numbers and categories and the staff planning system; the key persons implementing 200 including the compliance monitoring manager; an organisation chart of accountability; the internal reporting scheme; the procedures ensuring compliance, in particular the 200(c) documentation, the control of contracted activities and the ISMM amendment procedure; and the approved alternative means of compliance. The initial ISMM is approved and a copy retained by the authority (no approval for declared organisations, since Regulation (EU) 2025/2293); the ISMM is amended to stay current with copies of amendments to the authority; amendments outside the organisation's own amendment procedure, and those tied to 255(b) changes, need authority approval except for declared organisations; the ISMM may be integrated into other expositions with clear cross-references.